Simultaneous-Use := 2 and MySQL
I configured mysql to use for accounting and can see information in radacct. If I don't set a nas type in clients.conf will Simultaneous-Use only use SQL to check if a user is logged in and not use checkrad (correct)? Also I continue to get the error where setting Simultaneous-Use to :=2 it fails (nas type not set). See information below When set to Simultaneous-Use := 1 (second user below) [sql] expand: %{User-Name} -> preilly [sql] sql_set_user escaped user --> 'preilly' [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'preilly' ORDER BY id [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'preilly' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'preilly' ORDER BY priority [sql] expand: %{User-Name} -> preilly [sql] sql_set_user escaped user --> 'preilly' [sql] expand: SELECT COUNT(*) #FROM radacct #WHERE username = '%{SQL-User-Name}' #AND acctstoptime IS NULL -> SELECT COUNT(*) #FROM radacct #WHERE username = 'preilly' #AND acctstoptime IS NULL [sql] expand: SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL -> SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = 'preilly' AND acctstoptime IS NULL Multiple logins (max 1) : [preilly] (from client Cisco port 0 via TLS tunnel) User-Name = "preilly" [suffix] No '@' in User-Name = "preilly", looking up realm NULL Login incorrect: [preilly/<via Auth-Type = EAP>] (from client Cisco port 13 cli 58-b0-35-67-b6-ed) [attr_filter.access_reject] expand: %{User-Name} -> preilly Simultaneous-Use := 2 USER 1: Login OK: [preilly] (from client Cisco port 0 via TLS tunnel) expand: %{User-Name} -> preilly expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=preilly) [ldap] performing search in OU=EPSD,DC=win,DC=eastpennsd,DC=org, with filter (sAMAccountName=preilly) User-Name = "preilly" User-Name = "preilly" User-Name = "preilly" [suffix] No '@' in User-Name = "preilly", looking up realm NULL Login OK: [preilly] (from client Cisco port 13 cli 60-33-4b-0a-35-7b) expand: %{User-Name} -> preilly expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=preilly) [ldap] performing search in OU=EPSD,DC=win,DC=eastpennsd,DC=org, with filter (sAMAccountName=preilly) User-Name = "preilly" User-Name = "preilly" [acct_unique] Hashing 'NAS-Port = 13,Client-IP-Address = 172.23.160.4,NAS-IP-Address = 172.23.160.4,Acct-Session-Id = "54edc53c/60:33:4b:0a:35:7b/815513",User-Name = "preilly"' [suffix] No '@' in User-Name = "preilly", looking up realm NULL [sql] expand: %{User-Name} -> preilly [sql] sql_set_user escaped user --> 'preilly' USER 2: Login OK: [preilly] (from client Cisco port 0 via TLS tunnel) expand: %{User-Name} -> preilly expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=preilly) [ldap] performing search in OU=EPSD,DC=win,DC=eastpennsd,DC=org, with filter (sAMAccountName=preilly) User-Name = "preilly" User-Name = "preilly" User-Name = "preilly" [suffix] No '@' in User-Name = "preilly", looking up realm NULL Login OK: [preilly] (from client Cisco port 13 cli 58-b0-35-67-b6-ed) expand: %{User-Name} -> preilly expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=preilly) [ldap] performing search in OU=EPSD,DC=win,DC=eastpennsd,DC=org, with filter (sAMAccountName=preilly) User-Name = "preilly" User-Name = "preilly" [acct_unique] Hashing 'NAS-Port = 13,Client-IP-Address = 172.23.160.4,NAS-IP-Address = 172.23.160.4,Acct-Session-Id = "54edccc5/58:b0:35:67:b6:ed/816142",User-Name = "preilly"' [suffix] No '@' in User-Name = "preilly", looking up realm NULL [sql] expand: %{User-Name} -> preilly [sql] sql_set_user escaped user --> 'preilly' [attr_filter.accounting_response] expand: %{User-Name} -> preilly USER 3: Login OK: [preilly] (from client Cisco port 0 via TLS tunnel) expand: %{User-Name} -> preilly expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=preilly) [ldap] performing search in OU=EPSD,DC=win,DC=eastpennsd,DC=org, with filter (sAMAccountName=preilly) User-Name = "preilly" User-Name = "preilly" User-Name = "preilly" [suffix] No '@' in User-Name = "preilly", looking up realm NULL Login OK: [preilly] (from client Cisco port 13 cli 24-a2-e1-d4-66-07) expand: %{User-Name} -> preilly expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=preilly) [ldap] performing search in OU=EPSD,DC=win,DC=eastpennsd,DC=org, with filter (sAMAccountName=preilly) User-Name = "preilly" User-Name = "preilly" [acct_unique] Hashing 'NAS-Port = 13,Client-IP-Address = 172.23.160.4,NAS-IP-Address = 172.23.160.4,Acct-Session-Id = "54edd0ed/24:a2:e1:d4:66:07/816564",User-Name = "preilly"' [suffix] No '@' in User-Name = "preilly", looking up realm NULL [sql] expand: %{User-Name} -> preilly [sql] sql_set_user escaped user --> 'preilly' [attr_filter.accounting_response] expand: %{User-Name} -> preilly Below is the table in SQL with all 3 logged in: mysql> select * from radacct; +-----------+-----------------------------------+------------------+----------+-----------+-------+--------------+-----------+-----------------+---------------------+--------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+ | radacctid | acctsessionid | acctuniqueid | username | groupname | realm | nasipaddress | nasportid | nasporttype | acctstarttime | acctstoptime | acctsessiontime | acctauthentic | connectinfo_start | connectinfo_stop | acctinputoctets | acctoutputoctets | calledstationid | callingstationid | acctterminatecause | servicetype | framedprotocol | framedipaddress | acctstartdelay | acctstopdelay | xascendsessionsvrkey | +-----------+-----------------------------------+------------------+----------+-----------+-------+--------------+-----------+-----------------+---------------------+--------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+ | 101 | 54edc53c/60:33:4b:0a:35:7b/815513 | 218dd0fa625ec043 | preilly | | | 172.23.160.4 | 13 | Wireless-802.11 | 2015-02-25 07:51:08 | NULL | 2844 | RADIUS | | NULL | 1198146 | 2596646 | 172.23.160.4 | 172.26.160.75 | | | | 172.26.160.75 | 0 | NULL | | | 102 | 54edccc5/58:b0:35:67:b6:ed/816142 | def07acd9c4933a3 | preilly | | | 172.23.160.4 | 13 | Wireless-802.11 | 2015-02-25 08:23:18 | NULL | 978 | RADIUS | | NULL | 130719 | 19886 | 172.23.160.4 | 172.26.161.254 | | | | 172.26.161.254 | 0 | NULL | | | 103 | 54edd0ed/24:a2:e1:d4:66:07/816564 | 72262aa1fafe27d4 | preilly | | | 172.23.160.4 | 13 | Wireless-802.11 | 2015-02-25 08:41:01 | NULL | 0 | RADIUS | | | 0 | 0 | 172.23.160.4 | 172.26.162.1 | | | | 172.26.162.1 | 0 | 0 | | +-----------+-----------------------------------+------------------+----------+-----------+-------+--------------+-----------+-----------------+---------------------+--------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------------------+ 3 rows in set (0.00 sec) From Paul Reilly
On Feb 25, 2015, at 8:43 AM, Reilly, Paul <preilly@eastpennsd.org> wrote:
I configured mysql to use for accounting and can see information in redact.
That isn’t enough. There needs to be enough information to UNIQUELY identify a session. The typical use-case is in a GGSN or DSL concentrator, where every user is assigned a unique NAS port. That isn’t happening here. Which is likely the sourceof the problem.
If I don't set a nas type in clients.conf will Simultaneous-Use only use SQL to check if a user is logged in and not use checkrad (correct)?
Simultaneous-Use means that the server ALWAYS uses the “session” section to check how many times a user is logged in. If it’s below the limit, nothing further is done. The new session is allowed. If it’s at or above the limit, then checkrad MAY be used to see if the NAS really thinks the user is still logged in. That check is done because historically accounting packets could get lost. Then the sessions wouldn’t be marked as “stopped”, even if they really were stopped. checkrad is used ONLY if the NAS type is known. To be honest, checkrad should just go away. Modern systems are much better than they used to be at keeping accounting up to date. If your network is losing accounting packets, the solution is to fix the network, not to butcher it some more by doing crappy SNMP checks.
Also I continue to get the error where setting Simultaneous-Use to :=2 it fails (nas type not set). See information below
Read the REST of the debug output. What is it doing in the “session” section? Did you even configure that? And if the debug log is too big to post… don’t post logs showing it works. They’re useless. Show logs where it DOESN’T work. Because 99% of the time, the information about WHY it doesn’t work is in the debug log. Alan DeKok.
participants (2)
-
Alan DeKok -
Reilly, Paul